How to perform security testing and input validation for Web Applications

Today, when web applications are dominant, mainstream hackers are turning their targets to Web applications, SQL injection, XSS... various attack techniques emerge in an endless stream, but the fly does not bite the eggs seamlessly. So many attack techniques are nothing more than sending toxic content to the egg. Therefore, as long as the input validation is done well, the 90%-95% attack can be prevented. How can we do input validation to make up for all the gaps as much as possible? The following considerations may help you

 

1. Find all input points of the Web application, and find all input points that can accept user input. If the Input Point is missed, the possible seams are missed.

2. filter each input point and set the corresponding validation rules and boundaries for each input point.

3. Do not forget to verify the hidden domains, cookies, and URL parameters.

4. verify the data obtained from the database. This is the easiest thing to ignore. Do not trust that the data from the database is legal.

5. How do you perform input validation? Javascript? If you only use JavaScript for client-side verification, the risk is still very high. Be sure to add the server-side verification. Otherwise, if the client disables JavaScript or the clientCodeIf the data is manually modified, it still enters the system.

6. the exception information is hidden, and comprehensive verification cannot cover all cases. If illegal data causes system exceptions, do not expose detailed exception information to the client, such exception information may be the entrance to system attacks.

 

When performing input verification, starting with "what kind of input is valid" will reduce the risk of verification failure. We should only set a limited number for the input content of each input point, just enough legal scope, and all other content is regarded as illegal. Starting with "what kind of input is illegal" will increase the possibility of invalid verification, because it is impossible for you to give up illegal input.